﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace PacoToolKit.Sql
{
    public class Common
    {
        ///<summary>
        ///防止SQL注入式攻击
        ///</summary>
        ///<param name="inputString">where条件</param>
        public static string ConvertSql(string inputString)
        {
            inputString = inputString.ToLower();
            inputString = inputString.Trim(); //去空格
            inputString = inputString.Replace("'", ""); //去单引号
            inputString = inputString.Replace(";", ""); //去分号
            inputString = inputString.Replace("=", ""); //去等号
            inputString = inputString.Replace(" or ", ""); //去 or
            inputString = inputString.Replace(" and ", ""); //去 and
            inputString = inputString.Replace(" like ", ""); //去 通配符
            inputString = inputString.Replace(";--", ""); //去注释
            inputString = inputString.Replace("insert ", "").Replace("insert/**/", ""); //去插入语句
            inputString = inputString.Replace("update ", "").Replace("update/**/", ""); //去修改语句
            inputString = inputString.Replace("delete ", "").Replace("delete/**/", ""); //去删除语句
            inputString = inputString.Replace("create ", "").Replace("create/**/", ""); //去新建语句
            inputString = inputString.Replace("exec ", "").Replace("exec/**/", ""); //去执行语句
            inputString = inputString.Replace("drop ", "").Replace("drop/**/", ""); //去删除语句
            inputString = inputString.Replace("truncate ", ""); //去清表语句
            inputString = inputString.Replace("xp_cmdshell", ""); //
            return inputString;
        }
    }
}
